Skip to content
MalwareWiki

Loader

EugenLoader

aka FakeBat · NUMOZYLOD · PaykLoader

A loader written in Powershell, usually delivered packaged in MSI/MSIX files.

EugenLoader, also known as FakeBat, NUMOZYLOD, PaykLoader, is a PowerShell loader operated by APOTHECARY SPIDER and Storm-1113.

Background

A PowerShell-based loader that is typically distributed bundled inside MSI/MSIX packages.

Source: Malpedia (Fraunhofer FKIE).